// security
$ tail -f ./security
Headlines from early disclosure channels, research labs and curated news, each with a short summary.
# Today
-
Vulnerabilities in PHP Affecting Cisco Products: October 2026
Two critical PHP remote code execution vulnerabilities, CVE-2026-109618 and CVE-2026-109619, affect certain Cisco products.
# Yesterday
-
Multiple Cisco Products Snort 3 SMTP MIME Denial of Service Vulnerability
A Snort 3 SMTP MIME parsing flaw in multiple Cisco products could let a remote attacker cause a denial-of-service restart.
-
Multiple Cisco Products Snort 3 Security Hardening Release: October 2026
Snort 3 hardening updates address multiple internally discovered out-of-bounds write vulnerabilities tracked by CVE-2026-20043.
-
Multiple Cisco Products Snort 3 Denial of Service Vulnerabilities
Multiple Cisco products using Snort 3 detection engine have denial-of-service vulnerabilities that could cause unexpected restarts.
-
Multiple Cisco Products Snort 3 Generic Routing Encapsulation Denial of Service Vulnerability
Multiple Cisco products using Snort 3 may restart unexpectedly if a remote attacker sends crafted GRE traffic exploiting improper handling of nested GRE packets.
-
Multiple Cisco Products Snort 3 Denial of Service Vulnerability
A vulnerability in Cisco Snort 3 Detection Engine could let a remote unauthenticated attacker cause a denial-of-service condition through crafted GTP traffic.
-
Multiple Cisco Products Snort 3 Visual Basic for Applications Buffer Overflow Denial of Service Vulnerability
Cisco has disclosed a buffer overflow vulnerability in Snort 3 VBA decompression that can cause a remote denial of service.
# 21 Oct
-
Cisco Advance Notification for Publication of October 21, 2026, Security Advisories
Security advisories were published by Cisco on October 21, 2026, including updates related to Snort 3.
-
Cisco Secure Client Secure Firewall Posture Module Privilege Escalation Vulnerability
A privilege escalation vulnerability exists in Cisco Secure Client's Secure Firewall Posture module due to insufficient IPC input validation.
-
Open Source Snort 3 Control Channel Socket Arbitrary Command Execution Vulnerability
A Snort 3 vulnerability lets an authenticated local low-privilege user execute arbitrary commands as the Snort process through an unauthenticated control channel socket.
-
Cisco Unified Communications Products Security Hardening Release: October 2026
A security hardening release for Cisco Unified Communications products follows an internal review of voice and collaboration platforms.
-
Cisco Expressway Series Remote Code Execution Vulnerability
A Cisco Expressway Series vulnerability allows an unauthenticated remote attacker with network access to execute OS commands as root due to database service issues.
-
Cisco Expressway Series Security Hardening Release: October 2026
A security hardening release for Cisco Expressway Series addresses multiple internally discovered vulnerabilities not known to be actively exploited.
-
Cisco Unified Communications Manager Improper Access Control Vulnerability
A Cisco Unified Communications Manager improper access control flaw could allow unauthenticated remote attackers to bypass controls through crafted HTTP requests.
-
Cisco IOS XR Software for ASR 9000 Series Routers IPv4 Unicast Packets Denial of Service Vulnerability
A Cisco IOS XR flaw on ASR 9000-series routers could let remote attackers cause denial of service via crafted IPv4 packets.
-
Cisco Expressway Series Information Disclosure Vulnerability
The Expressway Series has an unauthenticated remote information disclosure vulnerability caused by insufficient HTTP authorization checks during Mobile and Remote Access provisioning.